CVE-2021-42052: Ipesa E-Flow

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

IPESA e-Flow 3.3.6 allows path traversal for reading any file within the web root directory via the lib/js/build/STEResource.res path and the R query parameter.

Affected products

• Ipesa E-Flow: version 3.3.6 only

Published 2022-08-16. Last modified 2026-06-17.